diff --git a/setup/azurecmdfiles.wxi b/setup/azurecmdfiles.wxi
index eb1f3f283574..3f8b3a6ea295 100644
--- a/setup/azurecmdfiles.wxi
+++ b/setup/azurecmdfiles.wxi
@@ -1184,6 +1184,9 @@
+
+
+
@@ -3434,6 +3437,7 @@
+
diff --git a/src/ResourceManager/Resources/AzureRM.Resources.psd1 b/src/ResourceManager/Resources/AzureRM.Resources.psd1
index e0cd91251587..5979a8addab6 100644
--- a/src/ResourceManager/Resources/AzureRM.Resources.psd1
+++ b/src/ResourceManager/Resources/AzureRM.Resources.psd1
@@ -54,8 +54,9 @@ CLRVersion = '4.0'
RequiredModules = @(@{ModuleName = 'AzureRM.Profile'; ModuleVersion = '4.0.0'; })
# Assemblies that must be loaded prior to importing this module
-RequiredAssemblies = '.\Microsoft.Azure.Management.ResourceManager.dll',
- '.\Microsoft.Azure.ResourceManager.dll'
+RequiredAssemblies = '.\Microsoft.Azure.Management.ResourceManager.dll',
+ '.\Microsoft.Azure.ResourceManager.dll',
+ '.\Microsoft.Azure.Management.Authorization.dll'
# Script files (.ps1) that are run in the caller's environment prior to importing this module.
# ScriptsToProcess = @()
diff --git a/src/ResourceManager/Resources/ChangeLog.md b/src/ResourceManager/Resources/ChangeLog.md
index a65c7102903c..cfaea2836b45 100644
--- a/src/ResourceManager/Resources/ChangeLog.md
+++ b/src/ResourceManager/Resources/ChangeLog.md
@@ -26,6 +26,8 @@
- Users can now use Set-AzureRMRoleRoleDefinition with assignable scopes including new scopes irrespective of the position of the scope
* Allow scopes to end with "/"
- Users can now use RoleDefinition and RoleAssignment commandlets with scopes ending with "/" ,consistent with API and CLI
+* Allow users to create RoleAssignment using delegation flag
+ - Users can now use New-AzureRMRoleAssignment with an option of adding the delegation flag
* Fix RoleAssignment get to respect the scope parameter
## Version 5.0.0
diff --git a/src/ResourceManager/Resources/Commands.Resources.Test/Commands.Resources.Test.csproj b/src/ResourceManager/Resources/Commands.Resources.Test/Commands.Resources.Test.csproj
index 1c7ca1b3ca6c..748d6d229e3f 100644
--- a/src/ResourceManager/Resources/Commands.Resources.Test/Commands.Resources.Test.csproj
+++ b/src/ResourceManager/Resources/Commands.Resources.Test/Commands.Resources.Test.csproj
@@ -61,6 +61,9 @@
False
..\..\..\packages\Microsoft.Azure.Graph.RBAC.3.4.0-preview\lib\net452\Microsoft.Azure.Graph.RBAC.dll
+
+ ..\..\..\packages\Microsoft.Azure.Management.Authorization.2.6.0-preview\lib\net452\Microsoft.Azure.Management.Authorization.dll
+
..\..\..\packages\Microsoft.Azure.Insights.0.10.0-preview\lib\net45\Microsoft.Azure.Insights.dll
@@ -246,10 +249,6 @@
{d3804b64-c0d3-48f8-82ec-1f632f833c9e}
Commands.Common.Authentication
-
- {24508e26-154d-47f1-80ee-439bf0710996}
- Commands.Common.Authorization
-
{269acf73-0a34-42dc-ab9c-4b15931a489d}
Commands.Common.Graph.RBAC
@@ -712,6 +711,9 @@
Always
+
+ Always
+
Always
diff --git a/src/ResourceManager/Resources/Commands.Resources.Test/Models.ResourceGroups/ResourceClientTests.cs b/src/ResourceManager/Resources/Commands.Resources.Test/Models.ResourceGroups/ResourceClientTests.cs
index 41beb1d0fdc6..22a455895b86 100644
--- a/src/ResourceManager/Resources/Commands.Resources.Test/Models.ResourceGroups/ResourceClientTests.cs
+++ b/src/ResourceManager/Resources/Commands.Resources.Test/Models.ResourceGroups/ResourceClientTests.cs
@@ -27,7 +27,7 @@
using Microsoft.Azure.Commands.ResourceManager.Cmdlets.SdkModels;
using Microsoft.Azure.Commands.Resources.Models;
using Microsoft.Azure.Commands.ScenarioTest;
-using Microsoft.Azure.Management.Authorization.Version2015_07_01;
+using Microsoft.Azure.Management.Authorization;
using Microsoft.Azure.Management.ResourceManager;
using Microsoft.Azure.Management.ResourceManager.Models;
using Microsoft.Rest.Azure;
diff --git a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ResourcesController.cs b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ResourcesController.cs
index 48eb8f1669d7..c86be82b016a 100644
--- a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ResourcesController.cs
+++ b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ResourcesController.cs
@@ -23,7 +23,7 @@
using Microsoft.Azure.Commands.ResourceManager.Cmdlets.Extensions;
using Microsoft.Azure.Graph.RBAC.Version1_6;
using Microsoft.Azure.Insights;
-using Microsoft.Azure.Management.Authorization.Version2015_07_01;
+using Microsoft.Azure.Management.Authorization;
using Microsoft.Azure.Management.ResourceManager;
using Microsoft.Azure.Test.HttpRecorder;
using Microsoft.Rest.ClientRuntime.Azure.TestFramework;
diff --git a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.cs b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.cs
index b0be63dd23d0..f9a1b95b7949 100644
--- a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.cs
+++ b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.cs
@@ -15,7 +15,7 @@
using Microsoft.Azure.Graph.RBAC.Version1_6;
using Microsoft.Azure.Graph.RBAC.Version1_6.Models;
-using Microsoft.Azure.Management.Authorization.Version2015_07_01;
+using Microsoft.Azure.Management.Authorization;
using Microsoft.Azure.Management.ResourceManager;
using Microsoft.Azure.Management.ResourceManager.Models;
using Microsoft.Azure.ServiceManagemenet.Common.Models;
@@ -115,6 +115,13 @@ public void RaDeletionByScopeAtRootScope()
{
ResourcesController.NewInstance.RunPsTest("Test-RaDeletionByScopeAtRootScope");
}
+
+ [Fact]
+ [Trait(Category.AcceptanceType, Category.CheckIn)]
+ public void RaDelegation()
+ {
+ ResourcesController.NewInstance.RunPsTest("Test-RaDelegation");
+ }
[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
diff --git a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.ps1 b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.ps1
index 1720f14e8b3a..3b3c6ede5559 100644
--- a/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.ps1
+++ b/src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.ps1
@@ -18,15 +18,15 @@ Tests retrieval of classic administrators
#>
function Test-RaClassicAdmins
{
- # Setup
- $subscription = Get-AzureRmSubscription
-
- # Test
- $classic = Get-AzureRmRoleAssignment -IncludeClassicAdministrators | Where-Object { $_.Scope -ieq ('/subscriptions/' + $subscription[0].Id) -and $_.RoleDefinitionName.ToLower().Contains('administrator')}
-
- # Assert
- Assert-NotNull $classic
- Assert-True { $classic.Length -ge 1 }
+ # Setup
+ $subscription = Get-AzureRmSubscription
+
+ # Test
+ $classic = Get-AzureRmRoleAssignment -IncludeClassicAdministrators | Where-Object { $_.Scope -ieq ('/subscriptions/' + $subscription[0].Id) -and $_.RoleDefinitionName.ToLower().Contains('administrator')}
+
+ # Assert
+ Assert-NotNull $classic
+ Assert-True { $classic.Length -ge 1 }
}
<#
@@ -41,11 +41,11 @@ function Test-RaNegativeScenarios
# Bad OID returns zero role assignments
$badOid = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
$badObjectResult = "Cannot find principal using the specified options"
- $assignments = Get-AzureRmRoleAssignment -ObjectId $badOid
+ $assignments = Get-AzureRmRoleAssignment -ObjectId $badOid
Assert-AreEqual 0 $assignments.Count
- # Bad OID throws if Expand Principal Groups included
- Assert-Throws { Get-AzureRmRoleAssignment -ObjectId $badOid -ExpandPrincipalGroups } $badObjectResult
+ # Bad OID throws if Expand Principal Groups included
+ Assert-Throws { Get-AzureRmRoleAssignment -ObjectId $badOid -ExpandPrincipalGroups } $badObjectResult
# Bad UPN
$badUpn = 'nonexistent@provider.com'
@@ -110,9 +110,9 @@ function Test-RaByScope
# Assert
Assert-NotNull $newAssignment
- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
- Assert-AreEqual $scope $newAssignment.Scope
- Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $scope $newAssignment.Scope
+ Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
VerifyRoleAssignmentDeleted $newAssignment
}
@@ -142,8 +142,8 @@ function Test-RaByResourceGroup
# Assert
Assert-NotNull $newAssignment
- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
- Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
VerifyRoleAssignmentDeleted $newAssignment
}
@@ -177,8 +177,8 @@ function Test-RaByResource
# Assert
Assert-NotNull $newAssignment
- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
- Assert-AreEqual $groups[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $groups[0].DisplayName $newAssignment.DisplayName
VerifyRoleAssignmentDeleted $newAssignment
}
@@ -261,9 +261,9 @@ function Test-RaByServicePrincipal
# Assert
Assert-NotNull $newAssignment
- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
- Assert-AreEqual $scope $newAssignment.Scope
- Assert-AreEqual $servicePrincipals[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $scope $newAssignment.Scope
+ Assert-AreEqual $servicePrincipals[0].DisplayName $newAssignment.DisplayName
VerifyRoleAssignmentDeleted $newAssignment
}
@@ -282,7 +282,7 @@ function Test-RaByUpn
Assert-AreEqual 1 $resourceGroups.Count "No resource group found. Unable to run the test."
# Test
- [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient]::RoleAssignmentNames.Enqueue("f8dac632-b879-42f9-b4ab-df2aab22a149")
+ [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient]::RoleAssignmentNames.Enqueue("f8dac632-b879-42f9-b4ab-df2aab22a149")
$newAssignment = New-AzureRmRoleAssignment `
-SignInName $users[0].UserPrincipalName `
-RoleDefinitionName $definitionName `
@@ -293,8 +293,8 @@ function Test-RaByUpn
# Assert
Assert-NotNull $newAssignment
- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
- Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
VerifyRoleAssignmentDeleted $newAssignment
}
@@ -305,11 +305,11 @@ function Test-RaUserPermissions
param([string]$rgName, [string]$action)
# Test
$rg = Get-AzureRmResourceGroup
- $errorMsg = "User should have access to only 1 RG. Found: {0}" -f $rg.Count
- Assert-AreEqual 1 $rg.Count $errorMsg
+ $errorMsg = "User should have access to only 1 RG. Found: {0}" -f $rg.Count
+ Assert-AreEqual 1 $rg.Count $errorMsg
- # User should not be able to create another RG as he doesnt have access to the subscription.
- Assert-Throws{ New-AzureRmResourceGroup -Name 'NewGroupFromTest' -Location 'WestUS'}
+ # User should not be able to create another RG as he doesnt have access to the subscription.
+ Assert-Throws{ New-AzureRmResourceGroup -Name 'NewGroupFromTest' -Location 'WestUS'}
}
<#
@@ -430,6 +430,42 @@ function Test-RaPropertiesValidation
VerifyRoleAssignmentDeleted $newAssignment
}
+<#
+.SYNOPSIS
+Tests verifies creation and retrieval of a RoleAssignments using delegation flag
+#>
+function Test-RaDelegation
+{
+ # Setup
+ $definitionName = 'Reader'
+ $users = Get-AzureRmADUser | Select-Object -First 1 -Wait
+ $subscription = Get-AzureRmSubscription
+ $resourceGroups = Get-AzureRmResourceGroup | Select-Object -Last 1 -Wait
+ $scope = '/subscriptions/'+ $subscription[0].Id +'/resourceGroups/' + $resourceGroups[0].ResourceGroupName
+ $assignmentScope = $scope +"/"
+ Assert-AreEqual 1 $users.Count "There should be at least one user to run the test."
+
+ # Test
+ [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient]::RoleAssignmentNames.Enqueue("f747531e-da33-43b9-b726-04675abf1939")
+ $newAssignment = New-AzureRmRoleAssignment `
+ -ObjectId $users[0].Id.Guid `
+ -RoleDefinitionName $definitionName `
+ -Scope $assignmentScope `
+ -AllowDelegation
+
+ # Assert
+ Assert-NotNull $newAssignment
+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
+ Assert-AreEqual $scope $newAssignment.Scope
+ Assert-AreEqual $users[0].DisplayName $newAssignment.DisplayName
+ Assert-AreEqual $true $newAssignment.CanDelegate
+
+ # cleanup
+ DeleteRoleAssignment $newAssignment
+
+ VerifyRoleAssignmentDeleted $newAssignment
+}
+
<